MENU
You have an application that uses an HTTP Cloud Function to process user activity from both desktop browser and mobile application clients. This function will serve as the endpoint for all metric submissions using HTTP POST.
Due to legacy restrictions, the function must be mapped to a domain that is separate from the domain requested by users on web or mobile sessions. The domain for the Cloud Function is https://fn.example.com. Desktop and mobile clients use the domain https://www.example.com. You need to add a header to the function's HTTP response so that only those browser and mobile sessions can submit metrics to the Cloud Function. Which response header should you add?
Suggested Answer: C
Get Premium Professional Cloud Developer Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
34 comments · newest first
NA
Nadine
11 months ago
Why is fn.example.com even separate? That’s odd!
FL
Flo
11 months ago
Wait, can we really use wildcards in that header?
IS
Isabella
11 months ago
I’m leaning towards D, seems more secure.
NG
Nguyet
11 months ago
Definitely not A, that opens it up too much!
HE
Hershel
12 months ago
I think option B is the right choice. It allows both domains.
OW
Owen
12 months ago
I recall that we need to restrict access to just the desktop and mobile clients, so I think option D could be the correct answer.
JA
James
1 year ago
I’m a bit confused about the wildcard in option A. I thought it would be too permissive for this scenario.
CH
Charolette
1 year ago
I think we practiced a similar question about allowing specific origins. I feel like option B might be the right choice since it allows both domains.
GL
Glynda
1 year ago
I remember we discussed CORS headers in class, but I'm not entirely sure which one to choose here.
TH
Thersa
1 year ago
This seems straightforward. The question states that the Cloud Function is on a separate domain, so the correct answer must be option C to allow access from that specific domain.
CO
Corazon
1 year ago
Okay, I think I've got it. Since the Cloud Function is on a separate domain (fn.example.com) from the desktop and mobile clients (www.example.com), we need to set the Access-Control-Allow-Origin header to the client domain, which is option D.
DO
Dominga
1 year ago
Hmm, I'm a bit confused. The question mentions that the Cloud Function is on a separate domain, but it's not clear if that means the desktop and mobile clients are on a different domain as well. I'll need to think this through carefully.
GA
Gaston
1 year ago
This seems like a straightforward CORS-related question. I think the key is to identify the correct domain that should be allowed to access the Cloud Function.
DA
Dahlia
1 year ago
The PA-Series is a good general-purpose firewall, but for a microservices environment, I'd go with the VM-Series. It's designed to be more flexible and scalable for virtualized and cloud-based deployments.
TH
Theron
1 year ago
Wait, I thought T1 connections had a higher bandwidth than that. Let me double-check my notes... Ah, I see, the maximum bandwidth is 1.544 Mbps. Thanks for the refresher, I'm feeling more confident now.
MI
Mi
1 year ago
I think the special folder permission is "Delete". That allows you to remove the folder and all its contents, which seems more powerful than just read or modify access.
NA
Nadine
1 year ago
I keep mixing up 'docker run' and 'docker exec.' I need to double-check which one is appropriate for an already running container.
JU
Justine
1 year ago
Hmm, I'm leaning towards B. Seems like a good compromise to allow any subdomain under example.com. Keeps things flexible, you know?
CH
Chi
1 year ago
Hold up, why not just make it accessible to everyone? I mean, who needs security these days, right? *wink wink*
LU
Luisa
1 year ago
Exactly, we want to ensure that only requests from the designated domains are allowed to access the function.
RO
Rosalind
1 year ago
C) Access-Control-Allow-Origin: https://fn.example.com
FR
Francine
1 year ago
No, we need to restrict it to only the specified domains for security reasons.
KE
Keva
1 year ago
A) Access-Control-Allow-Origin: *
RO
Ronald
1 year ago
I agree with Bethanie. C is the way to go here. Gotta keep those pesky hackers out, you know?
GE
Gerald
1 year ago
C) Access-Control-Allow-Origin: https://fn.example.com
TH
Theodora
1 year ago
B) Access-Control-Allow-Origin: https://*.example.com
CL
Clorinda
1 year ago
A) Access-Control-Allow-Origin: *
BE
Bethanie
1 year ago
Option C is the correct answer. The Cloud Function should only allow requests from the domain that users access, which is https://www.example.com.
LO
Lorrie
1 year ago
C) Access-Control-Allow-Origin: https://fn.example.com
KE
Kelvin
1 year ago
B) Access-Control-Allow-Origin: https://*.example.com
HY
Hyman
1 year ago
A) Access-Control-Allow-Origin: *
AL
Allene
2 years ago
I agree with Ahmad, C) Access-Control-Allow-Origin: https://fn.example.com makes sense because it restricts submissions to the Cloud Function from the specific domain
LA
Lacresha
2 years ago
I disagree, I believe the header should be A) Access-Control-Allow-Origin: *
AH
Ahmad
2 years ago
I think the correct header to add is C) Access-Control-Allow-Origin: https://fn.example.com